[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F2PW9310QDGCX9AA4FPA8":3,"skill-same:01M71F2PW9310QDGCX9AA4FPA8":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":14,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M71F2PW9310QDGCX9AA4FPA8","malware-triage-ir-respond",null,"| | **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-triage-ir-respond\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31],"respond","malware","triage","malware triage ir respond","sharing","behavior","classification","variants","family","cybersecurity","patterns","code","infrastructure","2026-11-10 10:12:30",false,"---\nname: malware-triage-ir-respond\ndescription: \"| | **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.\"\ndomain: cybersecurity\n---\n\n|\n| **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.g., Qakbot, Emotet, Cobalt Strike) |\n| **Process Hollowing** | Technique where malware creates a legitimate process in a suspended state, replaces its memory with malicious code, then resumes execution |\n| **Beacon** | Periodic network communication from malware to its C2 server, typically with a set interval and jitter for detection evasion |\n| **Dropper** | Initial malware component that downloads or unpacks the primary payload; often delivered via phishing |\n| **Persistence Mechanism** | Method used by malware to survive system reboots (registry run keys, scheduled tasks, services, WMI event subscriptions) |\n| **IOC (Indicator of Compromise)** | Observable artifact such as file hash, IP address, domain, or registry key that indicates malware presence |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon \u002F Microsoft Defender for Endpoint**: EDR platforms for detection, containment, and threat hunting\n- **ANY.RUN \u002F Joe Sandbox**: Interactive malware sandboxes for dynamic behavioral analysis\n- **VirusTotal \u002F MalwareBazaar**: Malware intelligence platforms for sample identification and IOC enrichment\n- **KAPE (Kroll Artifact Parser and Extractor)**: Forensic triage tool for rapid artifact collection from infected endpoints\n- **YARA**: Pattern-matching engine for creating custom malware detection rules based on observed indicators\n\n## Common Scenarios\n\n### Scenario: Emotet Loader Leading to Cobalt Strike Deployment\n\n**Context**: EDR detects a macro-enabled document that spawns PowerShell, downloads an Emotet DLL, which subsequently loads a Cobalt Strike beacon. Three hosts are infected within 45 minutes.\n\n**Approach**:\n1. Immediately isolate all three hosts and block C2 IPs at the perimeter\n2. Search email gateway for all recipients of the original phishing email and quarantine it\n3. Sweep all endpoints for the Emotet DLL hash and Cobalt Strike beacon indicators\n4. Analyze the Cobalt Strike beacon configuration to extract watermark, C2 profile, and staging URLs\n5. Check for credential harvesting (Mimikatz\u002FLSASS dump) and lateral movement artifacts\n6. Eradicate all malware artifacts and reset credentials for affected users\n\n**Pitfalls**:\n- Focusing only on Emotet and missing the Cobalt Strike second-stage payload\n- Failing to extract and block the Cobalt Strike Malleable C2 profile indicators\n- Not checking for additional persistence beyond the initial detection (Emotet often installs multiple backup persistence mechanisms)\n\n## Output Format\n\n```\nMALWARE INCIDENT RESPONSE REPORT\n=================================\nIncident:         INC-2025-1547\nMalware Family:   Qakbot (variant: Obama265)\nDelivery Vector:  Spearphishing attachment (Invoice-Nov2025.docm)\nFirst Detection:  2025-11-15T14:23:17Z\nScope:            4 endpoints confirmed infected\n\nINFECTION TIMELINE\n14:18 UTC - Phishing email received by jsmith@corp.example.com\n14:19 UTC - Macro executed in WINWORD.EXE\n14:20 UTC - PowerShell downloads update.exe from staging server\n14:21 UTC - update.exe establishes persistence (Scheduled Task)\n14:23 UTC - C2 beacon initiated to 185.220.101[.]42\n14:35 UTC - Lateral spread to WKSTN-087 via stolen credentials\n14:42 UTC - EDR detection fires, SOC alerted\n\nIOCs EXTRACTED\nFile Hashes:  [SHA-256 list]\nC2 Domains:   [domain list]\nC2 IPs:       [IP list]\nFile Paths:   [artifact paths]\n\nERADICATION STATUS\n[x] All malware artifacts removed from 4 hosts\n[x] Persistence mechanisms deleted\n[x] C2 infrastructure blocked\n[x] Compromised credentials reset\n[x] Email quarantined from all mailboxes\n\nRECOMMENDATIONS\n1. Deploy YARA rule for Qakbot variant detection\n2. Block macro execution in documents from external senders\n3. Implement application whitelisting on finance workstations\n```\n","|\n| **Malware Family** | Classification of malware variants sharing code, infrastructure, or behavior patterns (e.g., Qakbot, Emotet, Cobalt Strike) |\n| **Process Hollowing** | Technique where malware creates a legitimate process in a suspended state, replaces its memory with malicious code, then resumes execution |\n| **Beacon** | Periodic network communication from malware to its C2 server, typically with a set interval and jitter for detection evasion |\n| **Dropper** | Initial malware component that downloads or unpacks the primary payload; often delivered via phishing |\n| **Persistence Mechanism** | Method used by malware to survive system reboots (registry run keys, scheduled tasks, services, WMI event subscriptions) |\n| **IOC (Indicator of Compromise)** | Observable artifact such as file hash, IP address, domain, or registry key that indicates malware presence |\n\n## Tools & Systems\n\n- **CrowdStrike Falcon \u002F Microsoft Defender for Endpoint**: EDR platforms for detection, containment, and threat hunting\n- **ANY.RUN \u002F Joe Sandbox**: Interactive malware sandboxes for dynamic behavioral analysis\n- **VirusTotal \u002F MalwareBazaar**: Malware intelligence platforms for sample identification and IOC enrichment\n- **KAPE (Kroll Artifact Parser and Extractor)**: Forensic triage tool for rapid artifact collection from infected endpoints\n- **YARA**: Pattern-matching engine for creating custom malware detection rules based on observed indicators\n\n## Common Scenarios\n\n### Scenario: Emotet Loader Leading to Cobalt Strike Deployment\n\n**Context**: EDR detects a macro-enabled document that spawns PowerShell, downloads an Emotet DLL, which subsequently loads a Cobalt Strike beacon. Three hosts are infected within 45 minutes.\n\n**Approach**:\n1. Immediately isolate all three hosts and block C2 IPs at the perimeter\n2. Search email gateway for all recipients of the original phishing email and quarantine it\n3. Sweep all endpoints for the Emotet DLL hash and Cobalt Strike beacon indicators\n4. Analyze the Cobalt Strike beacon configuration to extract watermark, C2 profile, and staging URLs\n5. Check for credential harvesting (Mimikatz\u002FLSASS dump) and lateral movement artifacts\n6. Eradicate all malware artifacts and reset credentials for affected users\n\n**Pitfalls**:\n- Focusing only on Emotet and missing the Cobalt Strike second-stage payload\n- Failing to extract and block the Cobalt Strike Malleable C2 profile indicators\n- Not checking for additional persistence beyond the initial detection (Emotet often installs multiple backup persistence mechanisms)\n\n## Output Format\n\n```\nMALWARE INCIDENT RESPONSE REPORT\n=================================\nIncident:         INC-2025-1547\nMalware Family:   Qakbot (variant: Obama265)\nDelivery Vector:  Spearphishing attachment (Invoice-Nov2025.docm)\nFirst Detection:  2025-11-15T14:23:17Z\nScope:            4 endpoints confirmed infected\n\nINFECTION TIMELINE\n14:18 UTC - Phishing email received by jsmith@corp.example.com\n14:19 UTC - Macro executed in WINWORD.EXE\n14:20 UTC - PowerShell downloads update.exe from staging server\n14:21 UTC - update.exe establishes persistence (Scheduled Task)\n14:23 UTC - C2 beacon initiated to 185.220.101[.]42\n14:35 UTC - Lateral spread to WKSTN-087 via stolen credentials\n14:42 UTC - EDR detection fires, SOC alerted\n\nIOCs EXTRACTED\nFile Hashes:  [SHA-256 list]\nC2 Domains:   [domain list]\nC2 IPs:       [IP list]\nFile Paths:   [artifact paths]\n\nERADICATION STATUS\n[x] All malware artifacts removed from 4 hosts\n[x] Persistence mechanisms deleted\n[x] C2 infrastructure blocked\n[x] Compromised credentials reset\n[x] Email quarantined from all mailboxes\n\nRECOMMENDATIONS\n1. Deploy YARA rule for Qakbot variant detection\n2. Block macro execution in documents from external senders\n3. Implement application whitelisting on finance workstations\n```\n",{"name":5,"domain":28,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware-triage-ir-respond","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill malware-triage-ir-respond",{"tool":50,"command":51},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill malware-triage-ir-respond",{"tool":53,"command":54},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill malware-triage-ir-respond","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-triage-ir-respond\u002FSKILL.md",true,[58],{"path":59,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":63},"index.json","REFERENCE","参考文档",588,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware-triage-ir-respond\u002Findex.json",[65,90,113,135,157,173],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":32},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,28,89],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":32},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[97,72,98,75,99,100,101,28,102,103,104,105,106,107,77,108,109,110,111,112],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":32},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[120,121,122,123,124,125,28,102,126,103,127,128,77,110,129,130,131,132,133,134],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":32},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[73,142,143,144,145,146,147,78,148,28,89,149,150,151,152,153,154,155,156,77],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":32},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[164,165,73,166,144,146,167,78,168,148,28,89,103,169,170,171,172,156,77,79],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":32},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[180,73,144,181,167,78,182,183,28,89,184,185,186,187,188,189,77,79,190,191],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]